chore(deps): bump the prod-dependencies group across 1 directory with 2 updates

[dependabot]

Bumps the prod-dependencies group with 2 updates in the / directory: @mongodb-js/saslprep and bson.

Updates @mongodb-js/saslprep from 1.4.11 to 1.4.12

Commits

• 04e390e chore(ci): bump packages
• 14b7668 chore(deps-dev): bump @​types/node from 22.15.31 to 25.5.2 (#649)
• d78b253 chore: update cidrs.json [skip ci]
• 12ef575 chore(ci): bump packages
• dcc663b fix(device-id): device id drift between devtools products and altas cli COMPA...
• f49e20e chore(ci): bump packages
• e9d7de3 fix(tracking-plan): identifyTraits must have payload (#805)
• a78ba11 chore(ci): bump packages
• 83e66d3 feat(mongodb-constants): update $unionWith template with db field COMPASS-998...
• 0424f26 chore: update cidrs.json [skip ci]
• Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by gribnoysup, a new releaser for @​mongodb-js/saslprep since your current version.

Updates bson from 7.2.0 to 7.3.1

Release notes

Sourced from bson's releases.

v7.3.1

7.3.1 (2026-06-23)

The MongoDB Node.js team is pleased to announce version 7.3.1 of the bson package!

Release Notes

ObjectId initialization now tolerates partial process polyfills

Adds optional chaining to Node.js startup snapshot API calls in ObjectId so that environments with a stubbed or partial process global no longer throw a TypeError at startup.

Bug Fixes

• NODE-7630: make startup snapshot calls more defensive (#899) (99433cd)

Documentation

• API
• Changelog

We invite you to try the bson library immediately, and report any issues to the NODE project.

v7.3.0

7.3.0 (2026-06-17)

The MongoDB Node.js team is pleased to announce version 7.3.0 of the bson package!

Release Notes

Deprecated inapplicable Long members on Timestamp

Timestamp inherits from Long for storage convenience, but it is semantically a (t, i) pair, not a general 64-bit integer. If you have called Long methods directly on Timestamp instances (for example toNumber(), getHighBits(), getLowBits(), or aithmetic and bitwise operations), those are now marked @deprecated with no runtime behavior changes. The .t and .i accessors provide direct, semantically consistent access to the two timestamp components.

BSON operations no longer throw on deeply nested documents

Core serialization and deserialization function (serialize, deserialize, calculateObjectSize) have been rewritten as iterative algorithms, so a sufficiently-nested document will no longer exhaust the call stack.

Behavior change: Code with Scope scopes are no longer promoted to DBRef

As a side effect of the rewrite, a Code with Scope scope that happens to carry $ref, $id, and $db keys is no longer promoted to a DBRef instance. The scope is returned as a plain object, which is the correct behavior: a scope represents JavaScript variable bindings, not a document reference.

new Binary(buffer, subType) now coerces subType to match BSON bytes

The Binary constructor now normalizes subtype inputs to match BSON serialization. Previously, passing a stringified subtype like '4' would cause a mismatch between the sub_type property (string '4') and the serialized BSON value (0x04). The constructor now converts inputs to ensure consistency.

EJSON.stringify now correctly handles all parameter combinations

Previously, calling EJSON.stringify(value, options, space) silently discarded the space parameter, producing unformatted output. This has been fixed so all documented call signatures work as expected:

... (truncated)

Changelog

Sourced from bson's changelog.

7.3.1 (2026-06-23)

Bug Fixes

• NODE-7630: make startup snapshot calls more defensive (#899) (99433cd)

7.3.0 (2026-06-17)

Features

• NODE-7069: deprecate Long members inapplicable to Timestamp (#887) (c5d1dd8)

Bug Fixes

• NODE-5937: rewrite deserializeObject as iterative, not recursive (#886) (0231603)
• NODE-7354: eagerly make Binary sub_type into a number (#858) (5b42c5a)
• NODE-7436: EJSON.stringify type signature (#870) (c949780)
• NODE-7575: reset ObjectId state when building startup snapshot (#884) (ba29d33)
• NODE-7606: restore serializer performance by removing generator-based iteration (#890) (7c4d1aa)
• NODE-7618: propagate serializing flags to the parsing frames (#891) (a7cee8c)
• NODE-7619: reject embedded BSON document sizes below minimum valid length (#892) (b43c657)

Commits

• 31bed5d chore(main): release 7.3.1 (#900)
• 99433cd fix(NODE-7630): make startup snapshot calls more defensive (#899)
• ef8995b chore(NODE-7522): update dependencies (#889)
• 2f7fdb1 chore(main): release 7.3.0 (#883)
• b43c657 fix(NODE-7619): reject embedded BSON document sizes below minimum valid lengt...
• a7cee8c fix(NODE-7618): propagate serializing flags to the parsing frames (#891)
• 7c4d1aa fix(NODE-7606): restore serializer performance by removing generator-based it...
• c5d1dd8 feat(NODE-7069): deprecate Long members inapplicable to Timestamp (#887)
• 0231603 fix(NODE-5937): rewrite deserializeObject as iterative, not recursive (#886)
• 2ea8dbb chore(NODE-7599): tighten workflow permissions and update docs (#888)
• Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for bson since your current version.